add Security.Cryptography to Version.Details

[oleksandr-didyk]

Context

Contributes to dotnet/source-build#3043.

Declaring the System.Security.Cryptography.Pkcs dependency in Version.Details.xml will allow source-build to replace the currently used 7.0.0 version with the n-1 version coming from previously source-built artifacts in the product / VMR build.

Without this change, once repo PvP is enabled, an ref pack of 7.0.0 will be bundled with the produced package, causing build time exceptions for consumers that try to load in the dependency.

This is a follow-up to #8818 - the change should've been included with the mentioned PR but the issue described was originally missed during testing.

Changes Made

• added an entry for System.Security.Cryptography.Pkcs: 7.0.0 to Version.Details.xml.

Testing

Notes

[rainersigwald]

I'll ask again: do we need anything else? What about

msbuild/eng/dependabot/Packages.props

Lines 34 to 35 in e33c367

	<PackageVersion Include="System.CodeDom" Version="7.0.0" />
	<PackageVersion Update="System.CodeDom" Condition="'$(SystemCodeDomVersion)' != ''" Version="$(SystemCodeDomVersion)" />

msbuild/eng/dependabot/Packages.props

Lines 46 to 47 in e33c367

	<PackageVersion Include="System.Security.Cryptography.Xml" Version="7.0.1" />
	<PackageVersion Update="System.Security.Cryptography.Xml" Condition="'$(SystemSecurityCryptographyXmlVersion)' != ''" Version="$(SystemSecurityCryptographyXmlVersion)" />

?

[oleksandr-didyk]

I'll ask again: do we need anything else?

Sorry about the extra PR, that was my blunder as I missed a step while testing the change and this dependency slipped in. This should be the last one hopefully

To explain my reluctance to include more of similar dependencies unless absolutely needed - source-build product build will take every entry in Version.Details.xml and bump its version to latest. This does not create a major difference between product build and repository build as dependencies included in the file are mostly managed by automation (e.g. Darc) and are already upgraded to latest during development.

When we are adding a pinned version to the Version.Details.xml we are creating a rift between the product build (which is using the latest version) and repository build (which is using the pinned version) in the source-build context. As such, if we do not need to we don't include extra pinned versions in Version.Details.xml